Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2024-28244MEDIUMKaTeX's maxExpand bypassed by Unicode sub/superscriptsEPSS 2.2%CVE-2022-23974—Pinot segment push endpoint has a vulnerability in unprotected environmentsEPSS 2.1%CVE-2021-27432—OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may aEPSS 1.9%CVE-2022-30635HIGHStack exhaustion when decoding certain messages in encoding/gobEPSS 1.9%CVE-2016-4425MEDIUMJansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via cEPSS 1.9%CVE-2021-3997—A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nestedEPSS 1.7%CVE-2021-21359MEDIUMDenial of Service in Page Error HandlingEPSS 1.7%CVE-2025-59789HIGHApache bRPC: Stack Exhaustion via Unbounded Recursion in JSON ParserEPSS 1.7%CVE-2022-31052MEDIUMURL previews can crash Synapse media repositories or Synapse monolithsEPSS 1.7%CVE-2022-41881MEDIUMNetty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be EPSS 1.6%CVE-2022-28773—Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial EPSS 1.5%CVE-2023-50262MEDIUMDompdf possible DoS caused by infinite recursion when parsing SVG imagesEPSS 1.5%CVE-2024-28243MEDIUMKaTeX's maxExpand bypassed by \edefEPSS 1.4%CVE-2024-8176HIGHLibexpat: expat: improper restriction of xml entity expansion depth in libexpatEPSS 1.4%CVE-2023-24472HIGHA denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially cEPSS 1.3%CVE-2026-25048HIGHxgrammar: Multi-layer nesting causes DoSEPSS 1.3%CVE-2026-93450HIGHgo-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and UnmarshalEPSS 1.3%CVE-2026-58280HIGH.NET Denial of Service VulnerabilityEPSS 1.3%CVE-2017-0886—Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticatedEPSS 1.2%CVE-2020-1898—The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could causeEPSS 1.2%